ZLAN5143D devices allow an attacker to bypass authentication by directly accessing internal URLs, exposing sensitive control interfaces. The lack of proper authentication means an adversary can execute privileged commands, alter configuration, or gain full control of the device. The weakness maps to the CWE‑306 category, indicating improper or missing authentication safeguards. The immediate consequence is unauthorized use of critical functions which could compromise both the integrity of the device and any processes it manages.

The vulnerability is limited to devices produced by ZLAN Information Technology Co., specifically the ZLAN5143D model. No versioning information is disclosed, so all units of this model are considered potentially affected.

The CVSS base score of 9.3 classifies this flaw as critical, underscoring its potential impact. However, the EPSS score is reported as less than 1%, suggesting that, in the observed period, the likelihood of exploitation remains low. The flaw is not listed in CISA’s KEV catalog, implying that no widespread active exploits have been identified. The likely attack vector is internal network communication, where an adversary can reach the vulnerable URLs without authentication. Manipulating these endpoints can grant unauthorized control over the device’s critical functions.